A new member of the steering committee asks why the organization should conduct a business impact analysis when it already has a risk assessment. Which answer BEST explains the purpose of a BIA?
Select an answer to reveal the explanation.
Short Explanation
A risk assessment asks what could go wrong and how likely it is; a BIA asks what hurts most if it stops and how fast you need it back. Different questions, different answers. Don't mix up the BIA with testing the plans; testing comes much later in the cycle.
Full Explanation
A business impact analysis examines the effect of disruption on business processes over time, regardless of the cause. It identifies critical processes and their dependencies, assesses operational, financial, legal and reputational impact as an outage lengthens, and establishes recovery requirements such as recovery time objectives, recovery point objectives and maximum tolerable downtime. These outputs drive continuity and recovery strategy and investment. Identifying threats, vulnerabilities and likelihood is the purpose of risk assessment; the two analyses are complementary, but a BIA focuses on consequence and timing rather than probability. Testing whether plans can restore systems within agreed objectives is plan testing and exercising, which follows the BIA, strategy selection and plan development. Selecting controls to bring risk within appetite is risk treatment, a separate activity informed by risk assessment. Exam caveat: the BIA is cause-agnostic; a process is critical whether it is interrupted by a cyberattack, a flood or a supplier failure. Operational check: confirm the BIA output lists each critical process with its owner, dependencies, impact over time and approved recovery objectives, and that continuity strategies reference those objectives.